feat(gateway): add per-workspace template count limit #2805

Summary

The handle_create_sandbox_template handler has no per-workspace count limit. A workspace admin can create an unlimited number of templates, potentially exhausting persistence storage and making list calls expensive.

Context

Identified during PR #2781 review. Individual template field sizes are validated (MAX_TEMPLATE_STRING_LEN, MAX_TEMPLATE_STRUCT_SIZE), but there is no aggregate quota per workspace.

This is part of a broader pattern: workspace-scoped resource quotas don't exist yet. The same concern applies to disruption protection (discussed in PR #2692 where a user could continuously create protected sandboxes to block cluster upgrades).

Proposed Change

Add a MAX_TEMPLATES_PER_WORKSPACE constant (e.g., 1000) and check the count before put_if in handle_create_sandbox_template. Return RESOURCE_EXHAUSTED if exceeded, consistent with how MAX_PROVIDERS caps provider attachments.

Consider whether this should be a gateway-level config (like maxDuration for disruption protection) rather than a hardcoded constant, to allow platform admins to tune per deployment.

Related

• PR feat(sandbox)!: introduce reusable sandbox templates #2781: Sandbox templates feature (introduces the template CRUD API)
• PR feat: add sandbox disruption protection #2692: Sandbox disruption protection (similar quota concern)